Re: [PATCH bpf-next v4 5/8] bpf: Fix generic __uninit kfunc output buffers

[Eduard Zingerman <eddyz87@gmail.com>]

On Fri, 2026-09-18 at 07:28 +0200, Kumar Kartikeya Dwivedi wrote:
> Stack liveness treats __uninit kfunc arguments as writes. Even with
> write-only access checks, ordinary clobber handling leaves poisoned stack
> bytes poisoned after the call, so the output cannot be read.
> 
> Reuse the helper output descriptor for generic kfunc buffers. Record the
> output after resolving its memory type, and initialize its stack bytes
> only after all arguments have been checked. This prevents an output from
> making an aliased, uninitialized input appear valid.
> 
> Track the output by its ABI argument slot, since a kfunc pointer may be
> passed on the stack or follow a multi-slot by-value argument. Keep the
> single-output restriction in prototype validation; multiple-output
> tracking is a separate extension.
> 
> Document that output buffers must be fully initialized on every return
> path, including error returns and padding.
> 
> Fixes: 2cb27158adb3 ("bpf: poison dead stack slots")
> Reported-by: Tejun Heo <tj@kernel.org>
> Link: https://lore.kernel.org/bpf/86d966ec88bbf27d21b2bb4e18c8aa00@kernel.org
> Suggested-by: Eduard Zingerman <eddyz87@gmail.com>
> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
> ---

Acked-by: Eduard Zingerman <eddyz87@gmail.com>